Privilege exec command for remote scp?

What I wish to do is automatically back up the configuration of all of my devices via SSH. I want to create a user specifically for this purpose, whose only capability is to remotely scp the startup-config from each device.

I am unable to determine what 'privilege exec level <privilege>' command I need to do to enable this. Everything I can think of results in 'Privilege denied' on the remote hosts. Debugging of SSH indicates that the remote session conducts the actual login process successfully.